# CVEs published 2025-07-25

219 CVEs were published on July 25, 2025: 17 critical, 79 high. Days are UTC.

- [CVE-2025-8173](https://cve.now/CVE-2025-8173.md): 1000 Projects ABC Courier Management System Add\_reciver.php sql injection (CVSS 6.9, 1000 Projects ABC Courier Management System)
- [CVE-2025-8172](https://cve.now/CVE-2025-8172.md): itsourcecode Employee Management System index.php sql injection (CVSS 5.3, itsourcecode Employee Management System)
- [CVE-2025-8101](https://cve.now/CVE-2025-8101.md): Linkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS) (CVSS 8.8, Linkify · linkifyjs)
- [CVE-2025-8171](https://cve.now/CVE-2025-8171.md): code-projects Document Management System insert.php unrestricted upload (CVSS 5.3, code-projects Document Management System)
- [CVE-2025-8170](https://cve.now/CVE-2025-8170.md): TOTOLINK T6 MQTT Packet meshSlaveDlfw tcpcheck\_net buffer overflow (CVSS 8.7, TOTOLINK T6)
- [CVE-2025-8169](https://cve.now/CVE-2025-8169.md): D-Link DIR-513 HTTP POST Request formSetWanPPTPpath formSetWanPPTPcallback buffer overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2025-8168](https://cve.now/CVE-2025-8168.md): D-Link DIR-513 formSetWanPPPoE websAspInit buffer overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2025-8167](https://cve.now/CVE-2025-8167.md): code-projects Church Donation System edit\_members.php cross site scripting (CVSS 5.1, code-projects Church Donation System)
- [CVE-2025-52455](https://cve.now/CVE-2025-52455.md): Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Locatio (CVSS 5.3, Salesforce Tableau Server)
- [CVE-2025-52454](https://cve.now/CVE-2025-52454.md): Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resourc (CVSS 8.2, Salesforce Tableau Server)
- [CVE-2025-52453](https://cve.now/CVE-2025-52453.md): Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource L (CVSS 8.2, Salesforce Tableau Server)
- [CVE-2025-8166](https://cve.now/CVE-2025-8166.md): code-projects Church Donation System HTTP POST Request index.php sql injection (CVSS 6.9, code-projects Church Donation System)
- [CVE-2025-52452](https://cve.now/CVE-2025-52452.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (CVSS 8.5, Salesforce Tableau Server)
- [CVE-2025-52449](https://cve.now/CVE-2025-52449.md): Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service mo (CVSS 8.5, Salesforce Tableau Server)
- [CVE-2025-52448](https://cve.now/CVE-2025-52448.md): Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modu (CVSS 8.1, Salesforce Tableau Server)
- [CVE-2025-52447](https://cve.now/CVE-2025-52447.md): Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc comman (CVSS 8.1, Salesforce Tableau Server)
- [CVE-2025-52446](https://cve.now/CVE-2025-52446.md): Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows I (CVSS 8.0, Salesforce Tableau Server)
- [CVE-2025-8165](https://cve.now/CVE-2025-8165.md): code-projects Food Review System approve\_reservation.php sql injection (CVSS 5.3, code-projects Food Review System)
- [CVE-2025-8164](https://cve.now/CVE-2025-8164.md): code-projects Public Chat Room send\_message.php sql injection (CVSS 5.3, code-projects Public Chat Room)
- [CVE-2025-8163](https://cve.now/CVE-2025-8163.md): deerwms deer-wms-2 list sql injection (CVSS 5.3, deerwms deer-wms-2)
- [CVE-2025-5449](https://cve.now/CVE-2025-5449.md): Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service (CVSS 6.5, libssh · Red Hat Enterprise Linux +1)
- [CVE-2025-8162](https://cve.now/CVE-2025-8162.md): deerwms deer-wms-2 list sql injection (CVSS 5.3, deerwms deer-wms-2)
- [CVE-2025-36728](https://cve.now/CVE-2025-36728.md): SimpleHelp Cross Site Request Forgery (CVSS 6.3, Simplehelp)
- [CVE-2025-36727](https://cve.now/CVE-2025-36727.md): SimpleHelp Inclusion of functionality from untrusted control sphere (CVSS 8.3, Simplehelp)
- [CVE-2025-8161](https://cve.now/CVE-2025-8161.md): deerwms deer-wms-2 export sql injection (CVSS 5.3, deerwms deer-wms-2)
- [CVE-2014-125119](https://cve.now/CVE-2014-125119.md): WinRAR \< 5.00 Filename Spoofing RCE (CVSS 8.4, RARLab WinRAR)
- [CVE-2025-3508](https://cve.now/CVE-2025-3508.md): Certain HP DesignJet products – Information disclosure (CVSS 6.0, Certain HP DesignJet products)
- [CVE-2022-4979](https://cve.now/CVE-2022-4979.md): Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSS (CVSS 5.1, Sitecore Experience Platform · Sitecore Content Mangemen… +1)
- [CVE-2015-10142](https://cve.now/CVE-2015-10142.md): Sitecore XP \< 8.0 and CMS \< 7.2 and \< 7.5 File Read via Known Path (CVSS 6.9, Sitecore Experience Platform · Sitecore Content Management…)
- [CVE-2025-34139](https://cve.now/CVE-2025-34139.md): Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read (CVSS 8.7, Sitecore Experience Manager · Sitecore Experience Platfo… +2)
- [CVE-2020-36850](https://cve.now/CVE-2020-36850.md): Sitecore JSS React Sample Application 11.0.0 - 14.0.1 Information Disclosure (CVSS 8.7, Sitecore JSS React Sample Application)
- [CVE-2016-15046](https://cve.now/CVE-2016-15046.md): Hanwha Techwin SSM 1.32 & 1.4 ActiveMQ File Upload RCE (CVSS 8.6, Hanwha Smart Security Manager)
- [CVE-2014-125115](https://cve.now/CVE-2014-125115.md): Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE (CVSS 10.0, Artica ST Pandora FMS)
- [CVE-2025-34114](https://cve.now/CVE-2025-34114.md): OpenBlow Missing Critical Security Headers (CVSS 8.4, Laser Romae s.r.l. OpenBlow)
- [CVE-2014-125114](https://cve.now/CVE-2014-125114.md): i-Ftp 2.20 Schedule.xml Stack-Based Buffer Overflow (CVSS 8.4, i-Ftp)
- [CVE-2014-125116](https://cve.now/CVE-2014-125116.md): HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection (CVSS 9.3, HybridAuth)
- [CVE-2013-10032](https://cve.now/CVE-2013-10032.md): GetSimple CMS 3.2.1 Authenticated RCE via Arbitrary PHP File Upload (CVSS 8.7, GetSimple CMS Project GetSimple CMS)
- [CVE-2014-125118](https://cve.now/CVE-2014-125118.md): eScan 5.5-2 Web Management Console Command Injection (CVSS 9.4, MicroWorld eScan Web Management Console)
- [CVE-2014-125117](https://cve.now/CVE-2014-125117.md): D-Link info.cgi POST Request Stack-Based Buffer Overflow RCE (CVSS 9.3, D-Link DSP-W215)
- [CVE-2024-13976](https://cve.now/CVE-2024-13976.md): Commvault 11.20.0 - 11.36.0 Windows Maintenance Installer DLL Injection (CVSS 8.5, Commvault for Windows)
- [CVE-2024-13975](https://cve.now/CVE-2024-13975.md): Commvault 11.20.0 - 11.36.0 Windows Access Nodes Compromise via Local File Server Agent Abuse (CVSS 8.5, Commvault)
- [CVE-2025-2329](https://cve.now/CVE-2025-2329.md): High traffic causes corrupt SPI packets in OpenThread leading to denial of service (CVSS 5.3, silabs.com OpenThread)
- [CVE-2025-34136](https://cve.now/CVE-2025-34136.md): Commvault CommServe Web Server Unauthenticated SQL Injection (CVSS 6.9, Commvault)
- [CVE-2025-3873](https://cve.now/CVE-2025-3873.md): Buffer overflow in Si91x crypto APIs (CVSS 6.0, silabs.com WiseConnect)
- [CVE-2025-38467](https://cve.now/CVE-2025-38467.md): drm/exynos: exynos7\_drm\_decon: add vblank check in IRQ handling (no CVSS, Linux)
- [CVE-2025-38466](https://cve.now/CVE-2025-38466.md): perf: Revert to requiring CAP\_SYS\_ADMIN for uprobes (CVSS 7.8, Linux)
- [CVE-2025-38465](https://cve.now/CVE-2025-38465.md): netlink: Fix wraparounds of sk-\>sk\_rmem\_alloc. (no CVSS, Linux)
- [CVE-2025-38464](https://cve.now/CVE-2025-38464.md): tipc: Fix use-after-free in tipc\_conn\_close(). (CVSS 7.8, Linux)
- [CVE-2025-38463](https://cve.now/CVE-2025-38463.md): tcp: Correct signedness in skb remaining space calculation (CVSS 7.8, Linux)
- [CVE-2025-38462](https://cve.now/CVE-2025-38462.md): vsock: Fix transport\_{g2h,h2g} TOCTOU (no CVSS, Linux)
- [CVE-2025-38461](https://cve.now/CVE-2025-38461.md): vsock: Fix transport\_\* TOCTOU (CVSS 7.0, Linux)
- [CVE-2025-38460](https://cve.now/CVE-2025-38460.md): atm: clip: Fix potential null-ptr-deref in to\_atmarpd(). (CVSS 7.0, Linux)
- [CVE-2025-38459](https://cve.now/CVE-2025-38459.md): atm: clip: Fix infinite recursive call of clip\_push(). (no CVSS, Linux)
- [CVE-2025-38458](https://cve.now/CVE-2025-38458.md): atm: clip: Fix NULL pointer dereference in vcc\_sendmsg() (no CVSS, Linux)
- [CVE-2025-38457](https://cve.now/CVE-2025-38457.md): net/sched: Abort \_\_tc\_modify\_qdisc if parent class does not exist (no CVSS, Linux)
- [CVE-2025-38456](https://cve.now/CVE-2025-38456.md): ipmi:msghandler: Fix potential memory corruption in ipmi\_create\_user() (CVSS 7.8, Linux)
- [CVE-2025-38455](https://cve.now/CVE-2025-38455.md): KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (CVSS 7.8, Linux)
- [CVE-2025-38454](https://cve.now/CVE-2025-38454.md): ALSA: ad1816a: Fix potential NULL pointer deref in snd\_card\_ad1816a\_pnp() (no CVSS, Linux)
- [CVE-2025-38453](https://cve.now/CVE-2025-38453.md): io\_uring/msg\_ring: ensure io\_kiocb freeing is deferred for RCU (CVSS 7.8, Linux)
- [CVE-2025-38452](https://cve.now/CVE-2025-38452.md): net: ethernet: rtsn: Fix a null pointer dereference in rtsn\_probe() (no CVSS, Linux)
- [CVE-2025-38451](https://cve.now/CVE-2025-38451.md): md/md-bitmap: fix GPF in bitmap\_get\_stats() (no CVSS, Linux)
- [CVE-2025-38450](https://cve.now/CVE-2025-38450.md): wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925\_sta\_set\_decap\_offload() (no CVSS, Linux)
- [CVE-2025-38449](https://cve.now/CVE-2025-38449.md): drm/gem: Acquire references on GEM handles for framebuffers (CVSS 7.8, Linux)
- [CVE-2025-38448](https://cve.now/CVE-2025-38448.md): usb: gadget: u\_serial: Fix race condition in TTY wakeup (no CVSS, Linux)
- [CVE-2025-38447](https://cve.now/CVE-2025-38447.md): mm/rmap: fix potential out-of-bounds page table access during batched unmap (CVSS 7.8, Linux)
- [CVE-2025-38446](https://cve.now/CVE-2025-38446.md): clk: imx: Fix an out-of-bounds access in dispmix\_csr\_clk\_dev\_data (CVSS 7.3, Linux)
- [CVE-2025-38445](https://cve.now/CVE-2025-38445.md): md/raid1: Fix stack memory use after return in raid1\_reshape (no CVSS, Linux)
- [CVE-2025-38444](https://cve.now/CVE-2025-38444.md): raid10: cleanup memleak at raid10\_make\_request (no CVSS, Linux)
- [CVE-2025-38443](https://cve.now/CVE-2025-38443.md): nbd: fix uaf in nbd\_genl\_connect() error path (no CVSS, Linux)
- [CVE-2025-38442](https://cve.now/CVE-2025-38442.md): block: reject bs \> ps block devices when THP is disabled (no CVSS, Linux)
- [CVE-2025-38441](https://cve.now/CVE-2025-38441.md): netfilter: flowtable: account for Ethernet header in nf\_flow\_pppoe\_proto() (no CVSS, Linux)
- [CVE-2025-38440](https://cve.now/CVE-2025-38440.md): net/mlx5e: Fix race between DIM disable and net\_dim() (CVSS 7.8, Linux)
- [CVE-2025-38439](https://cve.now/CVE-2025-38439.md): bnxt\_en: Set DMA unmap len correctly for XDP\_REDIRECT (CVSS 9.8, Linux)
- [CVE-2025-38438](https://cve.now/CVE-2025-38438.md): ASoC: SOF: Intel: hda: Use devm\_kstrdup() to avoid memleak. (no CVSS, Linux)
- [CVE-2025-38437](https://cve.now/CVE-2025-38437.md): ksmbd: fix potential use-after-free in oplock/lease break ack (CVSS 8.8, Linux)
- [CVE-2025-8160](https://cve.now/CVE-2025-8160.md): Tenda AC20 httpd SetSysTimeCfg buffer overflow (CVSS 8.7, Tenda AC20)
- [CVE-2025-38436](https://cve.now/CVE-2025-38436.md): drm/scheduler: signal scheduled fence when kill job (no CVSS, Linux)
- [CVE-2025-38435](https://cve.now/CVE-2025-38435.md): riscv: vector: Fix context save/restore with xtheadvector (CVSS 7.8, Linux)
- [CVE-2025-38434](https://cve.now/CVE-2025-38434.md): Revert "riscv: Define TASK\_SIZE\_MAX for \_\_access\_ok()" (CVSS 7.8, Linux)
- [CVE-2025-38433](https://cve.now/CVE-2025-38433.md): riscv: fix runtime constant support for nommu kernels (no CVSS, Linux)
- [CVE-2025-8159](https://cve.now/CVE-2025-8159.md): D-Link DIR-513 HTTP POST Request formLanguageChange stack-based overflow (CVSS 8.7, D-Link DIR-513)
- [CVE-2025-38432](https://cve.now/CVE-2025-38432.md): net: netpoll: Initialize UDP checksum field before checksumming (no CVSS, Linux)
- [CVE-2025-38431](https://cve.now/CVE-2025-38431.md): smb: client: fix regression with native SMB symlinks (no CVSS, Linux)
- [CVE-2025-38430](https://cve.now/CVE-2025-38430.md): nfsd: nfsd4\_spo\_must\_allow() must check this is a v4 compound request (CVSS 9.8, Linux)
- [CVE-2025-38429](https://cve.now/CVE-2025-38429.md): bus: mhi: ep: Update read pointer only after buffer is written (CVSS 10.0, Linux)
- [CVE-2025-38428](https://cve.now/CVE-2025-38428.md): Input: ims-pcu - check record size in ims\_pcu\_flash\_firmware() (no CVSS, Linux)
- [CVE-2025-38427](https://cve.now/CVE-2025-38427.md): video: screen\_info: Relocate framebuffers behind PCI bridges (no CVSS, Linux)
- [CVE-2025-38426](https://cve.now/CVE-2025-38426.md): drm/amdgpu: Add basic validation for RAS header (no CVSS, Linux)
- [CVE-2025-38425](https://cve.now/CVE-2025-38425.md): i2c: tegra: check msg length in SMBUS block read (CVSS 7.8, Linux)
- [CVE-2025-38424](https://cve.now/CVE-2025-38424.md): perf: Fix sample vs do\_exit() (CVSS 7.8, Linux)
- [CVE-2025-38423](https://cve.now/CVE-2025-38423.md): ASoC: codecs: wcd9375: Fix double free of regulator supplies (no CVSS, Linux)
- [CVE-2025-38422](https://cve.now/CVE-2025-38422.md): net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices (CVSS 7.8, Linux)
- [CVE-2025-38421](https://cve.now/CVE-2025-38421.md): platform/x86/amd: pmf: Use device managed allocations (CVSS 7.8, Linux)
- [CVE-2025-38420](https://cve.now/CVE-2025-38420.md): wifi: carl9170: do not ping device which has failed to load firmware (no CVSS, Linux)
- [CVE-2025-38419](https://cve.now/CVE-2025-38419.md): remoteproc: core: Cleanup acquired resources when rproc\_handle\_resources() fails in rproc\_attach() (no CVSS, Linux)
- [CVE-2025-38418](https://cve.now/CVE-2025-38418.md): remoteproc: core: Release rproc-\>clean\_table after rproc\_attach() fails (no CVSS, Linux)
- [CVE-2025-38417](https://cve.now/CVE-2025-38417.md): ice: fix eswitch code memory leak in reset scenario (no CVSS, Linux)
- [CVE-2025-38416](https://cve.now/CVE-2025-38416.md): NFC: nci: uart: Set tty-\>disc\_data only in success path (CVSS 7.8, Linux)
- [CVE-2025-38415](https://cve.now/CVE-2025-38415.md): Squashfs: check return result of sb\_min\_blocksize (no CVSS, Linux)
- [CVE-2025-38414](https://cve.now/CVE-2025-38414.md): wifi: ath12k: fix GCC\_GCC\_PCIE\_HOT\_RST definition for WCN7850 (no CVSS, Linux)
- [CVE-2025-8158](https://cve.now/CVE-2025-8158.md): PHPGurukul Login and User Management System yesterday-reg-users.php sql injection (CVSS 5.3, PHPGurukul Login and User Management System)
- [CVE-2025-38413](https://cve.now/CVE-2025-38413.md): virtio-net: xsk: rx: fix the frame's length check (CVSS 7.7, Linux)
- [CVE-2025-38412](https://cve.now/CVE-2025-38412.md): platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (CVSS 7.8, Linux)
- [CVE-2025-38411](https://cve.now/CVE-2025-38411.md): netfs: Fix double put of request (CVSS 9.8, Linux)
- [CVE-2025-38410](https://cve.now/CVE-2025-38410.md): drm/msm: Fix a fence leak in submit error path (no CVSS, Linux)
- [CVE-2025-38409](https://cve.now/CVE-2025-38409.md): drm/msm: Fix another leak in the submit error path (no CVSS, Linux)
- [CVE-2025-38408](https://cve.now/CVE-2025-38408.md): genirq/irq\_sim: Initialize work context pointers properly (CVSS 7.8, Linux)
- [CVE-2025-38407](https://cve.now/CVE-2025-38407.md): riscv: cpu\_ops\_sbi: Use static array for boot\_data (no CVSS, Linux)
- [CVE-2025-38406](https://cve.now/CVE-2025-38406.md): wifi: ath6kl: remove WARN on bad firmware input (no CVSS, Linux)
- [CVE-2025-38405](https://cve.now/CVE-2025-38405.md): nvmet: fix memory leak of bio integrity (CVSS 7.5, Linux)
- [CVE-2025-38404](https://cve.now/CVE-2025-38404.md): usb: typec: displayport: Fix potential deadlock (no CVSS, Linux)
- [CVE-2025-38403](https://cve.now/CVE-2025-38403.md): vsock/vmci: Clear the vmci transport packet properly when initializing it (no CVSS, Linux)
- [CVE-2025-8157](https://cve.now/CVE-2025-8157.md): PHPGurukul User Registration & Login and User Management lastthirtyays-reg-users.php sql injection (CVSS 5.3, PHPGurukul User Registration & Login and User Management)
- [CVE-2025-38402](https://cve.now/CVE-2025-38402.md): idpf: return 0 size for RSS key if not supported (no CVSS, Linux)
- [CVE-2025-38401](https://cve.now/CVE-2025-38401.md): mtk-sd: Prevent memory corruption from DMA map failure (CVSS 7.8, Linux)
- [CVE-2025-38400](https://cve.now/CVE-2025-38400.md): nfs: Clean up /proc/net/rpc/nfs when nfs\_fs\_proc\_net\_init() fails. (no CVSS, Linux)
- [CVE-2025-38399](https://cve.now/CVE-2025-38399.md): scsi: target: Fix NULL pointer dereference in core\_scsi3\_decode\_spec\_i\_port() (CVSS 7.5, Linux)
- [CVE-2025-38398](https://cve.now/CVE-2025-38398.md): spi: spi-qpic-snand: reallocate BAM transactions (CVSS 7.8, Linux)
- [CVE-2025-38397](https://cve.now/CVE-2025-38397.md): nvme-multipath: fix suspicious RCU usage warning (no CVSS, Linux)
- [CVE-2025-38396](https://cve.now/CVE-2025-38396.md): fs: export anon\_inode\_make\_secure\_inode() and fix secretmem LSM bypass (CVSS 7.8, Linux)
- [CVE-2025-38395](https://cve.now/CVE-2025-38395.md): regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (CVSS 8.4, Linux)
- [CVE-2025-38394](https://cve.now/CVE-2025-38394.md): HID: appletb-kbd: fix memory corruption of input\_handler\_list (no CVSS, Linux)
- [CVE-2025-38393](https://cve.now/CVE-2025-38393.md): NFSv4/pNFS: Fix a race to wake on NFS\_LAYOUT\_DRAIN (CVSS 7.5, Linux)
- [CVE-2025-38392](https://cve.now/CVE-2025-38392.md): idpf: convert control queue mutex to a spinlock (no CVSS, Linux)
- [CVE-2025-38391](https://cve.now/CVE-2025-38391.md): usb: typec: altmodes/displayport: do not index invalid pin\_assignments (no CVSS, Linux)
- [CVE-2025-38390](https://cve.now/CVE-2025-38390.md): firmware: arm\_ffa: Fix memory leak by freeing notifier callback node (no CVSS, Linux)
- [CVE-2025-38389](https://cve.now/CVE-2025-38389.md): drm/i915/gt: Fix timeline left held on VMA alloc error (no CVSS, Linux)
- [CVE-2025-38388](https://cve.now/CVE-2025-38388.md): firmware: arm\_ffa: Replace mutex with rwlock to avoid sleep in atomic context (no CVSS, Linux)
- [CVE-2025-38387](https://cve.now/CVE-2025-38387.md): RDMA/mlx5: Initialize obj\_event-\>obj\_sub\_list before xa\_insert (no CVSS, Linux)
- [CVE-2025-38386](https://cve.now/CVE-2025-38386.md): ACPICA: Refuse to evaluate a method if arguments are missing (CVSS 7.8, Linux)
- [CVE-2025-38385](https://cve.now/CVE-2025-38385.md): net: usb: lan78xx: fix WARN in \_\_netif\_napi\_del\_locked on disconnect (no CVSS, Linux)
- [CVE-2025-38384](https://cve.now/CVE-2025-38384.md): mtd: spinand: fix memory leak of ECC engine conf (no CVSS, Linux)
- [CVE-2025-38383](https://cve.now/CVE-2025-38383.md): mm/vmalloc: fix data race in show\_numa\_info() (no CVSS, Linux)
- [CVE-2025-38382](https://cve.now/CVE-2025-38382.md): btrfs: fix iteration of extrefs during log replay (CVSS 7.8, Linux)
- [CVE-2025-38381](https://cve.now/CVE-2025-38381.md): Input: cs40l50-vibra - fix potential NULL dereference in cs40l50\_upload\_owt() (no CVSS, Linux)
- [CVE-2025-38379](https://cve.now/CVE-2025-38379.md): smb: client: fix warning when reconnecting channel (CVSS 7.5, Linux)
- [CVE-2025-38378](https://cve.now/CVE-2025-38378.md): HID: appletb-kbd: fix slab use-after-free bug in appletb\_kbd\_probe (no CVSS, Linux)
- [CVE-2025-38377](https://cve.now/CVE-2025-38377.md): rose: fix dangling neighbour pointers in rose\_rt\_device\_down() (CVSS 8.8, Linux)
- [CVE-2025-38376](https://cve.now/CVE-2025-38376.md): usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (no CVSS, Linux)
- [CVE-2025-38375](https://cve.now/CVE-2025-38375.md): virtio-net: ensure the received length does not exceed allocated size (CVSS 8.4, Linux)
- [CVE-2025-38374](https://cve.now/CVE-2025-38374.md): optee: ffa: fix sleep in atomic context (no CVSS, Linux)
- [CVE-2025-38373](https://cve.now/CVE-2025-38373.md): IB/mlx5: Fix potential deadlock in MR deregistration (no CVSS, Linux)
- [CVE-2025-38372](https://cve.now/CVE-2025-38372.md): RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (CVSS 7.8, Linux)
- [CVE-2025-38371](https://cve.now/CVE-2025-38371.md): drm/v3d: Disable interrupts before resetting the GPU (no CVSS, Linux)
- [CVE-2025-38370](https://cve.now/CVE-2025-38370.md): btrfs: fix failure to rebuild free space tree using multiple transactions (no CVSS, Linux)
- [CVE-2025-38369](https://cve.now/CVE-2025-38369.md): dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (no CVSS, Linux)
- [CVE-2025-38368](https://cve.now/CVE-2025-38368.md): misc: tps6594-pfsm: Add NULL pointer check in tps6594\_pfsm\_probe() (no CVSS, Linux)
- [CVE-2025-38367](https://cve.now/CVE-2025-38367.md): LoongArch: KVM: Avoid overflow with array index (CVSS 8.8, Linux)
- [CVE-2025-38366](https://cve.now/CVE-2025-38366.md): LoongArch: KVM: Check validity of "num\_cpu" from user space (CVSS 7.8, Linux)
- [CVE-2025-38365](https://cve.now/CVE-2025-38365.md): btrfs: fix a race between renames and directory logging (CVSS 9.1, Linux)
- [CVE-2025-38364](https://cve.now/CVE-2025-38364.md): maple\_tree: fix MA\_STATE\_PREALLOC flag in mas\_preallocate() (no CVSS, Linux)
- [CVE-2025-38363](https://cve.now/CVE-2025-38363.md): drm/tegra: Fix a possible null pointer dereference (no CVSS, Linux)
- [CVE-2025-38362](https://cve.now/CVE-2025-38362.md): drm/amd/display: Add null pointer check for get\_first\_active\_display() (no CVSS, Linux)
- [CVE-2025-38361](https://cve.now/CVE-2025-38361.md): drm/amd/display: Check dce\_hwseq before dereferencing it (no CVSS, Linux)
- [CVE-2025-38360](https://cve.now/CVE-2025-38360.md): drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (no CVSS, Linux)
- [CVE-2025-38359](https://cve.now/CVE-2025-38359.md): s390/mm: Fix in\_atomic() handling in do\_secure\_storage\_access() (no CVSS, Linux)
- [CVE-2025-38358](https://cve.now/CVE-2025-38358.md): btrfs: fix race between async reclaim worker and close\_ctree() (no CVSS, Linux)
- [CVE-2025-38357](https://cve.now/CVE-2025-38357.md): fuse: fix runtime warning on truncate\_folio\_batch\_exceptionals() (CVSS 7.8, Linux)
- [CVE-2025-38356](https://cve.now/CVE-2025-38356.md): drm/xe/guc: Explicitly exit CT safe mode on unwind (no CVSS, Linux)
- [CVE-2025-38355](https://cve.now/CVE-2025-38355.md): drm/xe: Process deferred GGTT node removals on device unwind (no CVSS, Linux)
- [CVE-2025-38354](https://cve.now/CVE-2025-38354.md): drm/msm/gpu: Fix crash when throttling GPU immediately during boot (no CVSS, Linux)
- [CVE-2025-38353](https://cve.now/CVE-2025-38353.md): drm/xe: Fix taking invalid lock on wedge (no CVSS, Linux)
- [CVE-2025-8156](https://cve.now/CVE-2025-8156.md): PHPGurukul User Registration & Login and User Management lastsevendays-reg-users.php sql injection (CVSS 5.3, PHPGurukul User Registration & Login and User Management)
- [CVE-2025-8155](https://cve.now/CVE-2025-8155.md): D-Link DCS-6010L Management Application vb.htm cross site scripting (CVSS 5.1, D-Link DCS-6010L)
- [CVE-2025-5254](https://cve.now/CVE-2025-5254.md): Stored XSS in Kron Technologies' Kron PAM (CVSS 6.1, Kron Technologies Kron PAM)
- [CVE-2025-5253](https://cve.now/CVE-2025-5253.md): DoS in Kron Technologies' Kron PAM (CVSS 6.5, Kron Technologies Kron PAM)
- [CVE-2025-8183](https://cve.now/CVE-2025-8183.md): NULL Pointer Dereference in µD3TN (CVSS 7.5, µD3TN · pyd3tn)
- [CVE-2025-8140](https://cve.now/CVE-2025-8140.md): TOTOLINK A702R HTTP POST Request formWlanMultipleAP buffer overflow (CVSS 8.7, TOTOLINK A702R)
- [CVE-2025-8139](https://cve.now/CVE-2025-8139.md): TOTOLINK A702R HTTP POST Request formPortFw buffer overflow (CVSS 8.7, TOTOLINK A702R)
- [CVE-2023-7306](https://cve.now/CVE-2023-7306.md): Frontend File Manager \<= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 7.5, nmedia Frontend File Manager Plugin)
- [CVE-2025-8138](https://cve.now/CVE-2025-8138.md): TOTOLINK A702R HTTP POST Request formOneKeyAccessButton buffer overflow (CVSS 8.7, TOTOLINK A702R)
- [CVE-2025-8137](https://cve.now/CVE-2025-8137.md): TOTOLINK A702R HTTP POST Request formIpQoS buffer overflow (CVSS 8.7, TOTOLINK A702R)
- [CVE-2025-8136](https://cve.now/CVE-2025-8136.md): TOTOLINK A702R HTTP POST Request formFilter buffer overflow (CVSS 8.7, TOTOLINK A702R)
- [CVE-2025-5835](https://cve.now/CVE-2025-5835.md): Droip \<= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Many Actions (CVSS 8.8, Droip)
- [CVE-2025-5831](https://cve.now/CVE-2025-5831.md): Droip \< 2.5.2 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, Droip)
- [CVE-2025-8135](https://cve.now/CVE-2025-8135.md): itsourcecode Insurance Management System updateAgent.php sql injection (CVSS 5.3, itsourcecode Insurance Management System)
- [CVE-2025-8134](https://cve.now/CVE-2025-8134.md): PHPGurukul BP Monitoring Management System bwdates-report-result.php sql injection (CVSS 5.3, PHPGurukul BP Monitoring Management System)
- [CVE-2025-7022](https://cve.now/CVE-2025-7022.md): My Reservation System \<= 2.3 - Reflected XSS (CVSS 6.1, My Reservation System)
- [CVE-2025-8133](https://cve.now/CVE-2025-8133.md): yanyutao0402 ChanCMS gather.js getArticle server-side request forgery (CVSS 5.3, yanyutao0402 ChanCMS)
- [CVE-2025-8132](https://cve.now/CVE-2025-8132.md): yanyutao0402 ChanCMS utils.js delfile path traversal (CVSS 5.3, yanyutao0402 ChanCMS)
- [CVE-2025-8131](https://cve.now/CVE-2025-8131.md): Tenda AC20 SetStaticRouteCfg stack-based overflow (CVSS 8.7, Tenda AC20)
- [CVE-2025-8129](https://cve.now/CVE-2025-8129.md): KoaJS Koa HTTP Header response.js back redirect (CVSS 5.1, KoaJS Koa · koa)
- [CVE-2025-8128](https://cve.now/CVE-2025-8128.md): zhousg letao product.js unrestricted upload (CVSS 5.3, zhousg letao)
- [CVE-2025-8127](https://cve.now/CVE-2025-8127.md): deerwms deer-wms-2 list sql injection (CVSS 5.3, deerwms deer-wms-2)
- [CVE-2019-25224](https://cve.now/CVE-2019-25224.md): WP Database Backup \< 5.2 - Unauthenticated OS Command Injection (CVSS 9.8, databasebackup WP Database Backup – Unlimited Database & Fi…)
- [CVE-2015-10143](https://cve.now/CVE-2015-10143.md): Platform \< 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options Update (CVSS 9.8, PageLines Platform)
- [CVE-2015-10144](https://cve.now/CVE-2015-10144.md): Responsive Thumbnail Slider \< 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, nik00726 Thumbnail carousel slider)
- [CVE-2025-8126](https://cve.now/CVE-2025-8126.md): deerwms deer-wms-2 export sql injection (CVSS 5.3, deerwms deer-wms-2)
- [CVE-2025-8125](https://cve.now/CVE-2025-8125.md): deerwms deer-wms-2 allocatedList sql injection (CVSS 5.3, deerwms deer-wms-2)
- [CVE-2025-0253](https://cve.now/CVE-2025-0253.md): HCL IEM is affected by a cookie attribute not set vulnerability (CVSS 2.0, HCL Software IEM)
- [CVE-2025-0252](https://cve.now/CVE-2025-0252.md): HCL IEM is affected by a password in cleartext vulnerability (CVSS 2.6, HCL Software IEM)
- [CVE-2025-0251](https://cve.now/CVE-2025-0251.md): HCL IEM is affected by a concurrent login vulnerability (CVSS 2.6, HCL Software IEM)
- [CVE-2023-53155](https://cve.now/CVE-2023-53155.md): goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter. (CVSS 7.2, EmbedThis GoAhead)
- [CVE-2024-48729](https://cve.now/CVE-2024-48729.md): An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacke (CVSS 7.1)
- [CVE-2024-48730](https://cve.now/CVE-2024-48730.md): The default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authenticati (CVSS 6.5)
- [CVE-2025-29628](https://cve.now/CVE-2025-29628.md): A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home (CVSS 9.4, Gardyn Home Kit Firmware)
- [CVE-2025-29629](https://cve.now/CVE-2025-29629.md): Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak defa (CVSS 9.1, Gardyn Home Kit Firmware)
- [CVE-2025-29631](https://cve.now/CVE-2025-29631.md): Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command (CVSS 9.8, Gardyn Home Kit Firmware)
- [CVE-2025-30086](https://cve.now/CVE-2025-30086.md): CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak presen (CVSS 4.9, github.com/goharbor/harbor)
- [CVE-2025-30135](https://cve.now/CVE-2025-30135.md): An issue was discovered on IROAD Dashcam FX2 devices. (CVSS 9.4)
- [CVE-2025-43712](https://cve.now/CVE-2025-43712.md): JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. (CVSS 2.9, JHipster)
- [CVE-2025-44608](https://cve.now/CVE-2025-44608.md): CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter. (CVSS 6.5)
- [CVE-2025-45406](https://cve.now/CVE-2025-45406.md): A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a cra (CVSS 6.1)
- [CVE-2025-45466](https://cve.now/CVE-2025-45466.md): Unitree Go1 \<= Go1\_2022\_05\_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext. (CVSS 8.8)
- [CVE-2025-45467](https://cve.now/CVE-2025-45467.md): Unitree Go1 \<= Go1\_2022\_05\_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an (CVSS 7.1)
- [CVE-2025-45777](https://cve.now/CVE-2025-45777.md): An issue in the OTP mechanism of Chavara Family Welfare Centre Chavara Matrimony Site v2.0 allows attackers to bypass authentication via sup (CVSS 9.8)
- [CVE-2025-45892](https://cve.now/CVE-2025-45892.md): OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. (CVSS 6.1)
- [CVE-2025-45893](https://cve.now/CVE-2025-45893.md): OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. (CVSS 6.1)
- [CVE-2025-45939](https://cve.now/CVE-2025-45939.md): Apwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook function. (CVSS 6.5)
- [CVE-2025-45960](https://cve.now/CVE-2025-45960.md): Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application s (CVSS 6.1)
- [CVE-2025-46198](https://cve.now/CVE-2025-46198.md): Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attr (CVSS 8.8)
- [CVE-2025-46199](https://cve.now/CVE-2025-46199.md): Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form (CVSS 9.8)
- [CVE-2025-51411](https://cve.now/CVE-2025-51411.md): A reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0 via the email parameter in the /postqueryp (CVSS 6.1)
- [CVE-2025-52360](https://cve.now/CVE-2025-52360.md): A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05. (CVSS 8.8)
- [CVE-2025-54558](https://cve.now/CVE-2025-54558.md): OpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or --hostname-bin or --search-zip or -z flag. (CVSS 4.1, OpenAI Codex CLI)
- [CVE-2025-54566](https://cve.now/CVE-2025-54566.md): hw/pci/pcie\_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327. (CVSS 4.2, QEMU)
- [CVE-2025-54567](https://cve.now/CVE-2025-54567.md): hw/pci/pcie\_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327. (CVSS 4.2, QEMU)
- [CVE-2025-54568](https://cve.now/CVE-2025-54568.md): Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separat (CVSS 3.7, Akamai Rate Control)
- [CVE-2025-54596](https://cve.now/CVE-2025-54596.md): Abnormal Security /v1.0/rbac/users\_v2/{USER\_ID}/ before 2025-02-19 allows downgrading the privileges of other user accounts. (CVSS 4.3, Abnormal AI Abnormal Security)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.